Vermont H 639: An act relating to payment reform for adult day service providers

Bill Text

No. 135 Page 1 of 17
2026

VT LEG #390209 v.1
No. 135. An act relating to genetic data privacy.
(H.639)
It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. chapter 61A is added to read:
CHAPTER 61A. DATA PRIVACY
Subchapter 1. Genetic Information Privacy
§ 2421a. SHORT TITLE AND DEFINITIONS
(a) This subchapter shall be known, and may be cited, as the “Genetic
Information Privacy Act.”
(b) As used in this subchapter:
(1) “Affirmative authorization” means an action that demonstrates an
intentional decision by a consumer.
(2) “Biological sample” means any material part of the human,
discharge therefrom, or derivative thereof, such as tissue, blood, urine, or
saliva, known to contain deoxyribonucleic acid (DNA).
(3)(A) “Biometric data” means data generated from the technological
processing of a consumer’s unique biological, physical, or physiological
characteristics that allow or confirm the unique identification of the consumer,
including:
(i) iris or retina scans;
(ii) fingerprints;
(iii) facial or hand mapping, geometry, or templates;

No. 135 Page 2 of 17
2026

VT LEG #390209 v.1
(iv) vein patterns;
(v) voice prints or vocal biomarkers; and
(vi) gait or personally identifying physical movement or patterns.
(B) “Biometric data” does not include:
(i) a digital or physical photograph;
(ii) an audio or video recording; or
(iii) any data generated from a digital or physical photograph, or
an audio or video recording, unless such data is generated to identify a specific
consumer.
(4) “Consumer” means an individual who is a Vermont resident.
(5) “Dark pattern” means a user interface designed or manipulated with
the substantial effect of subverting or impairing user autonomy, decision
making, or choice.
(6) “Direct-to-consumer genetic testing company” means an entity that:
(A) sells, markets, interprets, or otherwise offers consumer-initiated
genetic testing products or services directly to consumers;
(B) analyzes genetic data obtained from a consumer, except to the
extent that the analysis is performed by a person licensed in the healing arts for
diagnosis or treatment of a medical condition; or
(C) collects, uses, maintains, or discloses genetic data that is:
(i) collected or derived from a direct-to-consumer genetic testing
product or service; or

No. 135 Page 3 of 17
2026

VT LEG #390209 v.1
(ii) directly provided by a consumer.
(7) “Disclose,” “disclosing,” or “disclosure” means to solicit, sell,
assign, transfer, give, provide, or trade, whether or not for valuable
consideration.
(8) “Express consent” means a consumer’s affirmative authorization to
grant permission in response to a clear, meaningful, and prominent notice
regarding the collection, use, maintenance, or disclosure of genetic data for a
specific purpose. Express consent cannot be inferred from inaction.
Agreement obtained through the use of dark patterns does not constitute
express consent.
(9)(A) “Genetic data” means any data, regardless of its format, that
results from the analysis of a biological sample from a consumer, or from
another element enabling equivalent information to be obtained, and concerns
genetic material. Genetic material includes deoxyribonucleic acids (DNA),
ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or
modifications to DNA or RNA, single nucleotide polymorphisms (SNPs),
uninterpreted data that results from the analysis of the biological sample, and
any information extrapolated, derived, or inferred therefrom.
(B) “Genetic data” does not include deidentified data. For purposes
of this subdivision (B), “deidentified data” means data that cannot be used to
infer information about, or otherwise be linked to, a particular individual,
provided that the business that possesses the information:

No. 135 Page 4 of 17
2026

VT LEG #390209 v.1
(i) takes reasonable measures to ensure that the information cannot
be associated with a consumer or household;
(ii) publicly commits to maintain and use the information only in
deidentified form and not to attempt to reidentify the information, except that
the business may periodically attempt to reidentify the information solely for
the purpose of determining whether its deidentification processes satisfy the
requirements of this subdivision (B), on the express condition that the business
does not use or disclose any information reidentified in this process and
destroys the reidentified information upon completion of that periodic
assessment; and
(iii) contractually obligates any recipients of the information to
take reasonable measures to ensure that the information cannot be associated
with a consumer or household and to commit to maintaining and using the
information only in deidentified form and not to reidentify the information.
(C) “Genetic data” does not include data or a biological sample to the
extent that data or a biological sample is collected, used, maintained, and
disclosed:
(i) exclusively for scientific research c